name: tauceti-worker

services:
  tauceti:
    build:
      context: .
    image: tauceti-worker:local
    init: true
    restart: unless-stopped
    stop_grace_period: 2m
    command: ["./tauceti", "work", "--loop"]
    environment:
      TAUCETI_WORKER_ID: docker
      TAUCETI_WORKER_ARGS: "${TAUCETI_WORKER_ARGS:-}"
      KIRO_API_KEY: "${KIRO_API_KEY:-}"
      OPENROUTER_API_KEY: "${OPENROUTER_API_KEY:-}"
      OPENROUTER_MANAGEMENT_KEY: "${OPENROUTER_MANAGEMENT_KEY:-}"
    volumes:
      # Agent and GitHub subscription credentials, created by the one-time login step.
      - claude-worker:/root/.claude:ro
      - codex-worker:/root/.codex:ro
      - kiro:/root/.local/share/kiro-cli:ro
      - gh:/root/.config/gh
      # Preserve build downloads when the image or isolated worker HOME changes. The pinned
      # Lean toolchain remains image-owned so an image update cannot be hidden by a stale volume.
      - uv-cache:/root/.cache/uv
      # Checkouts, scheduler state, and durable per-round logs.
      - checkouts:/opt/tauceti/checkouts
      - state:/opt/tauceti/state
      - logs:/opt/tauceti/logs

  # Explicit setup runner: unlike the worker, this service mounts credentials read-write.
  # Run it only for the documented one-time login commands, never as a long-running service.
  auth:
    image: tauceti-worker:local
    profiles: [setup]
    stdin_open: true
    tty: true
    command: ["bash"]
    environment:
      TAUCETI_SKIP_GIT_IDENTITY: "1"
    volumes:
      - claude:/root/.claude
      - codex:/root/.codex
      - kiro:/root/.local/share/kiro-cli
      - gh:/root/.config/gh

  # These are the only processes allowed to rotate each provider's shared refresh token.
  # TauCeti's isolated worker home mirrors their access tokens, avoiding refresh-token races.
  claude-refresh:
    image: tauceti-worker:local
    init: true
    restart: unless-stopped
    # Exceed the refresher's 15-second HTTP timeout so Docker cannot kill it after
    # the server rotates a token but before the replacement is persisted.
    stop_grace_period: 60s
    command: ["/usr/local/bin/tauceti-oauth-refresh", "claude"]
    environment:
      TAUCETI_SKIP_GIT_IDENTITY: "1"
      TAUCETI_REFRESH_MIRROR: /worker-credentials/.credentials.json
    volumes:
      - claude:/root/.claude
      - claude-worker:/worker-credentials

  codex-refresh:
    image: tauceti-worker:local
    init: true
    restart: unless-stopped
    stop_grace_period: 60s
    command: ["/usr/local/bin/tauceti-oauth-refresh", "codex"]
    environment:
      TAUCETI_SKIP_GIT_IDENTITY: "1"
      TAUCETI_REFRESH_MIRROR: /worker-credentials/auth.json
    volumes:
      - codex:/root/.codex
      - codex-worker:/worker-credentials

volumes:
  claude:
  codex:
  claude-worker:
  codex-worker:
  kiro:
  gh:
  uv-cache:
  checkouts:
  state:
  logs: